Every check ยท Exposed files
WordPress users
What it checks
/wp-json/wp/v2/users
Why it matters
The users endpoint gives authors' login names, half of what's needed to guess a password.
How to fix it
- Limit the users endpoint to signed-in users, with a security plugin or a rest_endpoints filter.
- Turn on two-factor sign-in for every account.
Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files